STIGQter: STIG Summary: Palo Alto Networks ALG Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 23 Oct 2020:

The Palo Alto Networks security platform must only enable User-ID on trusted zones.

DISA Rule

SV-228837r557387_rule

Vulnerability Number

V-228837

Group Title

SRG-NET-000131-ALG-000085

Rule Version

PANW-AG-000035

Severity

CAT II

CCI(s)

• CCI-000381 - The organization configures the information system to provide only essential capabilities.

Weight

10

Fix Recommendation

To deny User-ID on untrusted zones:
Go to Network >> Zones, select the name of the zone.
If the Zone is untrusted, In the Zone window, deselect (uncheck) the Enable User Identification check box.
Select "OK".
Go to Network >> Network Profiles >> Interface Mgmt
Select "Add" to create a new profile or select the name of a profile to edit it.
In the "Interface Management Profile" window, deselect the "User-ID" check box if it is selected.
Select "OK".

Note: This action precludes that particular Interface Management Profile from supporting User-ID.

An interface does not need an Interface Management Profile to operate; only to be managed on that interface.
Go Network >> Interfaces
Each interface is listed; note that there are four tabs - Ethernet, VLAN, Loopback, and Tunnel.
Each type can have an Interface Management Profile applied to it.
View each interface that is in an untrusted security zone; if it has an Interface Management Profile applied to it, the Interface Management Profile must be one that does not have User-ID enabled.

Check Contents

To verify that Windows Management Instrumentation (WMI) probing is unchecked for all untrusted zones:

Go to Network >> Zones, view each zone.
If the Zone is untrusted and if the UserID Enabled column is checked, this is a finding.

Go to Network >> Network Profiles >> Interface Mgmt
View the configured Interface Management Profiles.
Note which Interface Management Profiles have the "User-ID" field enabled (checked).
Go Network >> Interfaces
Each interface is listed; note that there are four tabs - Ethernet, VLAN, Loopback, and Tunnel. Each type can have an Interface Management Profile applied to it.

View each interface that is in an untrusted security zone; if each one has no Interface Management Profile applied, this is not a finding.

If each interface in an untrusted security zone has an Interface Management Profile applied to it, the Interface Management Profile must be one that does not have User-ID enabled; if it does, this is a finding.

Vulnerability Number

V-228837

Documentable

False

Rule Version

PANW-AG-000035

Severity Override Guidance

To verify that Windows Management Instrumentation (WMI) probing is unchecked for all untrusted zones:

Go to Network >> Zones, view each zone.
If the Zone is untrusted and if the UserID Enabled column is checked, this is a finding.

Go to Network >> Network Profiles >> Interface Mgmt
View the configured Interface Management Profiles.
Note which Interface Management Profiles have the "User-ID" field enabled (checked).
Go Network >> Interfaces
Each interface is listed; note that there are four tabs - Ethernet, VLAN, Loopback, and Tunnel. Each type can have an Interface Management Profile applied to it.

View each interface that is in an untrusted security zone; if each one has no Interface Management Profile applied, this is not a finding.

If each interface in an untrusted security zone has an Interface Management Profile applied to it, the Interface Management Profile must be one that does not have User-ID enabled; if it does, this is a finding.

Check Content Reference

M

Target Key

4233

Comments